AHA sues OCR over rule regulating the use of online tracking technologies

Photo: MoMo Productions/Getty Images

The American Hospital Association, the Texas Hospital Association and nonprofit health systems Texas Health Resource and the United Regional Health Care System are suing the federal government over a rule prohibiting the use of online tracking technologies on providers' public web pages.

The lawsuit against the Office for Civil Rights, Department of Health and Human Services, was filed Thursday in the U.S. District Court for the Northern District of Texas.

It challenges a December 2022 bulletin issued by the HHS Office for Civil Rights entitled "Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates." The bulletin bars hospitals from using standard third-party web technologies that capture IP addresses on portions of hospitals' public-facing web pages. 

Tracking technologies collect information and track users in various ways, many of which are not apparent to the website or mobile app user, OCR said in the bulletin. Websites commonly use tracking technologies such as cookies, web beacons or tracking pixels, session replay scripts and fingerprinting scripts to track and collect information from users. 

Insights gained through tracking could be used in beneficial ways to help improve care or the patient experience, OCR said. However, this tracking information could also be misused to promote misinformation, identity theft, stalking and harassment, OCR said.

The HIPAA Rules apply when the information that regulated entities collect through tracking technologies or disclose to tracking technology vendors includes protected health information, OCR said. 

The AHA claims that information sharing is vital and that hospitals and health systems use third-party technologies to enhance their websites. It prevents hospitals from using commonplace web technologies to analyze use of their websites and communicate effectively with the populations they serve.

For example, the AHA said that, under HHS' new rule, if someone visited a hospital website on behalf of her elderly neighbor to learn more about Alzheimer's disease, a hospital's use of any third-party technology that captures an IP address from that visit would expose that hospital to federal enforcement actions and significant civil penalties.

WHY THIS MATTERS

The AHA claims the bulletin was a "bolt-from-the-blue." 

The AHA and other plaintiffs are asking the court to stop enforcement of the bulletin's mandates.

The bulletin was issued without consulting healthcare providers.

Also, the government's own webpages use such technology, the AHA said. 

HHS' Medicare.gov, the Department of Defense Military Health System and Defense Health Agency, and various U.S. Veterans Health Administration sites continue to use these third-party technologies despite being covered entities under HIPAA. 

For example, forensic tools revealed that the Veterans Health Administration uses analytics and advertising tools on a wide range of sites, including online resources that describe the symptoms of post-traumatic stress disorder and point veterans to available treatment options, the AHA said. 

While dozens of hospitals across the country have received enforcement threats, and hospitals are currently under active investigation by OCR, the federal government has not halted its own use of these vital tools, the AHA said.

THE LARGER TREND

The bulletin was issued in December 2022.

In July 2023, OCR sent letters to approximately 130 hospital systems and telehealth providers warning them that the agency was "closely watching developments in this area." 

AHA, THA and Texas Health Resources have received such warning letters, according to the lawsuit.

Hospitals and other members of the AHA wish to use online technologies on Unauthenticated Public Webpages to collect and disclose what's called the "Proscribed Combination" of information to third-party technology vendors, but are refraining from doing so in various ways based on HHS's threat to enforce the bulletin, the AHA said.

They also want to employ analytic tools to improve website functionality by identifying and addressing areas in which community members struggle to find information, the AHA said. The bulletin stands in the way of using these tools, in part because many third-party technology vendors refuse to enter into a business associate agreement. 

ON THE RECORD

"The Department of Health and Human Services' new rule restricting the use of critical third-party technologies has real-world impacts on the public, who are now unable to access vital health information. In fact, these technologies are so essential that federal agencies themselves still use many of the same tools on their own webpages, including Medicare.gov, Tricare.mil, Health.mil, and various Veterans Health Administration sites. We cannot understand why HHS created this 'rule for thee but not for me,'" said Rick Pollack, AHA President and CEO.
 

Twitter: @SusanJMorse
Email the writer: SMorse@himss.org